- Newest
- Most votes
- Most comments
When a user's temporary password expires after the 3-day period, they can still use the forgot password workflow in Amazon Cognito. When the user initiates the forgot password process, Amazon Cognito will send a password reset code to their verified email address or phone number, depending on your user pool's account recovery settings.
The ForgotPassword operation starts a password recovery flow for a user by sending a confirmation code to the user's configured notification destination (such as email). This is separate from the initial temporary password invitation and works regardless of whether the initial invitation has expired.
Similarly, as an administrator, you can use the AdminResetUserPassword operation, which sets the user's account status to RESET_REQUIRED and sends them a password reset code. This operation is the administrative equivalent to the user-initiated ForgotPassword flow.
Amazon Cognito allows between 5 and 20 attempts per hour for a user to request or enter a password reset code, with the exact limit depending on risk parameters associated with the requests.
Sources
Passwords, account recovery, and password policies - Amazon Cognito
ForgotPassword - Amazon Cognito User Pools
Use ForgotPassword with an AWS SDK or CLI - Amazon Cognito
AdminResetUserPassword - Amazon Cognito User Pools
answered 10 months ago
Relevant content
asked 4 years ago
asked 2 years ago
- AWS OFFICIALUpdated 4 years ago
- AWS OFFICIALUpdated 4 years ago
- AWS OFFICIALUpdated 10 months ago
what if they have put the expired password in several times where they have locked their account and then triggered the forgot password code? i have all send and delivery event types going into a log and i do not see the forgot password email going out for this user, but I do see it for others.
after we manually reset the user's password they logged in and then the forgot password email worked. so i think the generated AI comment is wrong.